CVE-2011-2087
Apache Struts Multiple XSS Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.
- Record
CVE-2011-2087- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.
- Record
CVE-2011-2087- Updated
- 2026-11-02
EUVDEUVD-2022-2626 No score
Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in (1) FileHandler.java, (2) HiddenHandler.java, (3) PasswordHandler.java, (4) RadioHandler.java, (5) ResetHandler.java, (6) SelectHandler.java, (7) SubmitHandler.java, and (8) TextFieldHandler.java.
- Record
EUVD-2022-2626- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5pgj-r7c6-7c7w No score
Apache Struts Multiple XSS Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in
FileHandler.javaHiddenHandler.javaPasswordHandler.javaRadioHandler.javaResetHandler.javaSelectHandler.javaSubmitHandler.javaTextFieldHandler.java
- Record
GHSA-5pgj-r7c6-7c7w- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-5pgj-r7c6-7c7w No score
Apache Struts Multiple XSS Vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in component handlers in the javatemplates (aka Java Templates) plugin in Apache Struts 2.x before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via an arbitrary parameter value to a .action URI, related to improper handling of value attributes in
FileHandler.javaHiddenHandler.javaPasswordHandler.javaRadioHandler.javaResetHandler.javaSelectHandler.javaSubmitHandler.javaTextFieldHandler.java
- Record
GHSA-5pgj-r7c6-7c7w- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.struts:struts2-parentMaven |
before 2.2.3 | 2.2.3 |
org.apache.struts:struts2-parentMaven |
before 2.2.3, plus listed versions 2.0.112.0.11.12.0.11.22.0.122.0.14 Show 10 moreShow less2.0.52.0.62.0.82.0.92.1.22.1.62.1.82.1.8.12.2.12.2.1.1 |
2.2.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-2087 is a medium vulnerability (CVSS 4.3) in Apache Struts, published May 13, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.13%, the 93rd percentile. Fixed in org.apache.struts:struts2-parent 2.2.3.
References
issues.apache.org/jira/browse/WW-3597
vupen.com/english/advisories/2011/1198
struts.apache.org/2.2.3/docs/version-notes-223.html
nvd.nist.gov/vuln/detail/CVE-2011-2087
github.com/apache/struts/commit/1736b56db702c6639a6d5ae1146dba5a262e3344